2026

OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO in

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated `Content-

An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session stor

Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_det

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniSe

The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a mis

A TCP client can perform a TLS handshake and present the server name extension with a server name that is accepted by a

HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Polic

A vulnerability in an identity management API endpoint of Cisco ISE could allow an unauthenticated, remote attacker to e

HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its repor

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to o

Uninitialized Use in GPU in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rende

Race in Speech in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer proces

Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromise

A vulnerability was detected in PicoTronica e-Clinic Healthcare System ECHS 5.7. The affected element is an unknown func

OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media re

A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of t

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created f

OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In ver

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.

Improper restriction of excessive authentication attempts vulnerability in Hitachi Virtual Storage Platform G130, G150,

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorr

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Co

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elem

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Wishlist allows Exploiting Incor

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Secur

A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file f

The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp").

ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite functi

ParquetSharp is a .NET library for reading and writing Apache Parquet files. From version 18.1.0 to before version 23.0.

A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frm

Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated

A security flaw has been discovered in gyoridavid short-video-maker up to 1.3.4. This affects an unknown part of the fil

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From version 3.0.0 to before version 3.8.0, a vulner

The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local

In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrar

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and p

novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGa

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior

RedwoodSDK is a server-first React framework. From version 1.0.0-beta.50 to before version 1.2.3, server actions in rwsd

Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists

The LatePoint plugin for WordPress is vulnerable to Account Takeover via Weak Password Recovery Mechanism in the unauthe

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transm

A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c

A vulnerability was detected in Open5GS up to 2.7.7. This affects the function ogs_sbi_client_send_via_scp_or_sepp in th

The Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin for WordPress is vulnerable to A

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5